IT Unlike Any Other

Why antivirus companies like mine failed to catch Flame and Stuxnet

A couple of days ago, I received an e-mail from Iran. It was sent by an analyst from the Iranian Computer Emergency Response Team, and it was informing me about a piece of malware their team had found infecting a variety of Iranian computers. This turned out to be Flame: the malware that has now been front-page news worldwide.

When we went digging through our archive for related samples of malware, we were surprised to find that we already had samples of Flame, dating back to 2010 and 2011, that we were unaware we possessed. They had come through automated reporting mechanisms, but had never been flagged by the system as something we should examine closely. Researchers at other antivirus firms have found evidence that they received samples of the malware even earlier than this, indicating that the malware was older than 2010.

Very interesting that they (and others) had samples of the malware several years old, yet hadn’t examined it yet. I imagine they receive thousands of submissions, so I wonder what pushes a sample from the “submitted” queue to the “let’s have a closer look at this” queue.